A threat actor is any individual, group, or organization capable of carrying out an action that harms a system — the "who" behind a threat, as opposed to the vulnerability or technique they use to carry it out. A nation-state intelligence unit, a ransomware crew, a disgruntled former employee, and a curious teenager running a downloaded exploit script are all threat actors. They differ enormously in motivation, resources, and persistence, and that difference is exactly why naming them matters: the same unpatched server means something very different depending on who's looking at it.
Quick definition: A threat actor is a person or group with some combination of intent, capability, and opportunity to attack a system. Threat modeling frameworks use the term to separate "who might attack us" from "what could go wrong" — two questions that get conflated if you skip straight to listing vulnerabilities.
The main threat actor categories
Most threat modeling references group threat actors into a handful of archetypes, distinguished mainly by motivation and how much capability backs it up:
| Actor type | Typical motivation | Capability |
|---|---|---|
| Nation-state / APT | Espionage, sabotage, geopolitical advantage | Very high — custom tooling, zero-days, sustained multi-year campaigns |
| Organized cybercrime | Financial gain — ransomware, fraud, data resale | High — professional tooling, affiliate networks, dedicated infrastructure |
| Hacktivist | Ideological or political statement, reputational damage | Variable — ranges from defacement scripts to coordinated DDoS campaigns |
| Malicious insider | Revenge, financial gain, coercion by an outside party | High relative to effort — already has legitimate access and system knowledge |
| Negligent insider | None — harm is accidental, not intended | Low intent, but the access is real, so impact can still be severe |
| Opportunistic attacker | Low-effort financial gain, curiosity, notoriety | Low to moderate — automated scanners, off-the-shelf exploit kits |
| Competitor | Corporate espionage, competitive advantage | Variable — sometimes outsourced to contractors with real capability |
These categories are a starting point, not a checklist to fill in mechanically. A real threat model narrows this down to the two or three actor types that are actually plausible for the system in question — a marketing website and a payments backend do not share the same realistic adversary set, even if they share a hosting provider.
Why naming actors matters before you list threats
It's tempting to skip straight to "what could go wrong" — that's what STRIDE and similar checklists are built for. But a threat without an actor behind it is hard to size correctly. Likelihood, one of the two axes any risk score depends on, is really a question about actors: is there someone with the motivation, the capability, and the opportunity to actually pull this off? A theoretical timing side-channel that requires nation-state-level lab access is a very different risk than a default admin password that any opportunistic scanner will find in an afternoon, even though both are technically "vulnerabilities."
This is the practical value of naming threat actors early: it gives you a filter for triage. Once you know the plausible actors for a system — say, organized cybercrime and opportunistic attackers, but realistically not a nation-state — you can deprioritize threats that only make sense against a far more resourced adversary, and focus effort on the ones your actual likely attackers would pursue.
Threat actor vs. STRIDE vs. MITRE ATT&CK
These three sit at different layers, and it's worth being precise about how they connect. STRIDE is deliberately actor-agnostic — its six categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) describe classes of thing that could go wrong at a system element, regardless of who does it. That's a strength: it means STRIDE finds threats systematically even before you know who's likely to exploit them.
MITRE ATT&CK is where actors and techniques meet directly — its knowledge base doesn't just catalog techniques, it tracks specific named threat groups (APT29, FIN7, and hundreds of others) and the techniques each has been observed using. If your organization has reason to expect a specific actor category, ATT&CK lets you go further than the generic archetypes above and look at documented, real-world behavior for that class of adversary — which techniques they favor, which tactics they tend to skip.
An attack tree is where the actor question becomes concrete: the root goal of an attack tree is usually, implicitly, "what would this actor want badly enough to pursue." A hacktivist's root goal (public defacement, embarrassment) produces a very different tree than a ransomware crew's root goal (encrypt and extort) against the exact same system — same assets, same trust boundaries, different tree entirely.
Using threat actors in a threat modeling workflow
- Scope the actor list first — before walking STRIDE or building an attack tree, write down the two or three actor types that are actually plausible for this system, and why. This becomes the lens every threat gets evaluated through.
- Attach an actor to each significant threat — not as a formality, but as the justification for its likelihood score. "Who would actually do this" is a sharper question than "how likely is this, 1 to 5."
- Let actor scope drive attack tree root goals — build separate trees, or separate branches, for meaningfully different actor motivations rather than one tree trying to represent every adversary at once.
- Revisit the actor list when the system or its audience changes — a feature that starts serving hobbyists and later starts handling enterprise payroll data has, in effect, acquired new threat actors it didn't have before.